CVE-2019-10649

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.8-36 Q16

Description The issue is related to a memory leak in the SVGKeyValuePairs function of coders/svg.c, which can be exploited by an attacker to cause a denial of service via a crafted image file. This is due to errors in resource management. An attacker can exploit this issue to cause a denial of service using a specially formed image.

Recommendations For ImageMagick version 7.0.8-36 Q16, as a temporary workaround, consider disabling the SVGKeyValuePairs function until a patch is available. Restrict access to the coders/svg.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.